When Responsibility Extends Beyond Control

In July 2026, the Bank of England, the Prudential Regulation Authority and the Financial Conduct Authority began overseeing the first Critical Third Parties to the UK financial system, following HM Treasury’s designation of four major global technology and cloud service providers.

The measure responds to a transformation whose significance extends far beyond the financial sector.

Organisational autonomy has never been absolute. Institutions depend on resources, knowledge and infrastructures that extend across their boundaries. Yet when those dependencies come to encompass critical capabilities, the relationship between autonomy, control and responsibility becomes more demanding.

Technology, data and essential services can be outsourced, expanding access to expertise, scale and efficiency. But as those capabilities migrate to third parties, the formal perimeter of the organisation no longer coincides with the effective perimeter of its operations.

It is within this divergence that a central question of governance emerges.

An organisation may transfer the execution of a function without transferring, to the same extent, responsibility for the consequences of its failure. The greater the criticality and concentration, and the lower the substitutability, the more dependency ceases to be merely contractual and becomes embedded in the institution’s own architecture of capacity.

The new UK regime brings this tension into particularly sharp relief. Oversight of critical providers seeks to address the systemic risk created by shared dependencies, without relieving institutions themselves of responsibility for managing the third parties on which they rely.

The focus therefore shifts from the quality of an individual provider to the architecture of dependencies built around the organisation: where critical capacity is concentrated, which interdependencies remain less visible, what alternatives remain available, and how much scope for intervention survives when external infrastructure comes under pressure.

For decision-makers and institutional leaders, governing this reality requires more than contractual oversight. It requires an accurate map of the organisation’s dependencies, the ability to distinguish operational efficiency from structural concentration, and the preservation of alternatives before switching costs materially narrow the range of viable choices.

In increasingly interdependent systems, autonomy does not mean the absence of dependency. It means preserving the capacity to understand, govern and recalibrate those dependencies without compromising the organisation’s own room for decision.

Responsibility may remain internal even when control no longer lies entirely within the organisation.

Bank of England (2026). UK financial regulators to begin overseeing Critical Third Parties announced by HM Treasury. Published 10 July 2026.